@kensio/yulin 0.42.0 → 0.43.0

package/dist/service/cognito/user-pool/auth/sim-cognito-sign-in.js

@@ -0,0 +1,49 @@
+import { SimCognitoNotAuthorizedException } from "../../error/sim-cognito.error.js";
+import { requireSimCognitoUsername } from "../user/sim-cognito-username.js";
+/**
+ * Resolve the user a sign-in names, as the app client reports one that is not
+ * there.
+ *
+ * A client with `PreventUserExistenceErrors` of `ENABLED` answers with the
+ * same refusal a wrong password gets, and one left on the `LEGACY` default
+ * says the user does not exist.
+ */
+export function requireSimCognitoSignInUser(pool, client, username) {
+    const named = requireSimCognitoUsername(username);
+    if (!client.preventUserExistenceErrors.hidesUserExistence) {
+        return pool.requireUser(named);
+    }
+    const user = pool.findUser(named);
+    if (user === undefined) {
+        throw new SimCognitoNotAuthorizedException("Incorrect username or password.");
+    }
+    return user;
+}
+/**
+ * Refuse a user that has been disabled.
+ *
+ * Disabling a user stops it authenticating at all, so it is checked by a token
+ * refresh as well as by a sign-in: a user disabled after signing in cannot go
+ * on renewing its session.
+ */
+export function requireSimCognitoEnabled(user) {
+    if (!user.enabled) {
+        throw new SimCognitoNotAuthorizedException("User is disabled.");
+    }
+}
+/**
+ * Refuse a sign-in the user cannot make.
+ *
+ * A disabled user and a wrong password both fail as `NotAuthorizedException`,
+ * saying no more than real Cognito says. A user created without a
+ * `TemporaryPassword` has no password at all, so nothing matches: real Cognito
+ * generates one and sends it to the user, and nothing here delivers a message
+ * for the user to read it from.
+ */
+export function requireSimCognitoSignIn(user, password) {
+    requireSimCognitoEnabled(user);
+    if (!user.hasPassword(password)) {
+        throw new SimCognitoNotAuthorizedException("Incorrect username or password.");
+    }
+}
+//# sourceMappingURL=sim-cognito-sign-in.js.map

package/dist/service/cognito/user-pool/auth/sim-cognito-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-sign-in.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/auth/sim-cognito-sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAIpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAE5E;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAwB,EACxB,MAAgC,EAChC,QAAgB;IAEhB,MAAM,KAAK,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAElD,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC,kBAAkB,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAElC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,gCAAgC,CACxC,iCAAiC,CAClC,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAoB;IAC3D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,gCAAgC,CAAC,mBAAmB,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAoB,EACpB,QAAgB;IAEhB,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAE/B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,gCAAgC,CACxC,iCAAiC,CAClC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/service/cognito/user-pool/client/sim-cognito-prevent-user-existence-errors.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Whether an app client hides that a username does not exist.
+ *
+ * Real Cognito answers a sign-in naming an unknown user with
+ * `UserNotFoundException` under `LEGACY` and with the same
+ * `NotAuthorizedException` a wrong password gets under `ENABLED`. Which one a
+ * pool gives depends on this setting, so it is honoured rather than picked:
+ * a test asserting the generic error against a client that actually leaks
+ * existence is asserting the wrong thing.
+ *
+ * The API default is `LEGACY`, and a client created in the Cognito console
+ * gets `ENABLED`, so a client created here without the setting behaves the way
+ * a client created by an SDK call or a CloudFormation template does.
+ */
+export declare class SimCognitoPreventUserExistenceErrors {
+    readonly value: string;
+    constructor(requested: string | undefined);
+    /**
+     * Whether a sign-in naming an unknown user is refused as a wrong password
+     * rather than reported missing.
+     */
+    get hidesUserExistence(): boolean;
+}
+//# sourceMappingURL=sim-cognito-prevent-user-existence-errors.d.ts.map

package/dist/service/cognito/user-pool/client/sim-cognito-prevent-user-existence-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-prevent-user-existence-errors.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-prevent-user-existence-errors.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;;;GAaG;AACH,qBAAa,oCAAoC;IAC/C,SAAgB,KAAK,EAAE,MAAM,CAAC;IAE9B,YAAY,SAAS,EAAE,MAAM,GAAG,SAAS,EAcxC;IAED;;;OAGG;IACH,IAAI,kBAAkB,IAAI,OAAO,CAEhC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-prevent-user-existence-errors.js

@@ -0,0 +1,46 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+/**
+ * The setting that leaks whether a username exists, which is the API default.
+ */
+const legacy = "LEGACY";
+/**
+ * The setting that hides it, which the console applies to a new app client.
+ */
+const enabled = "ENABLED";
+const settings = [legacy, enabled];
+/**
+ * Whether an app client hides that a username does not exist.
+ *
+ * Real Cognito answers a sign-in naming an unknown user with
+ * `UserNotFoundException` under `LEGACY` and with the same
+ * `NotAuthorizedException` a wrong password gets under `ENABLED`. Which one a
+ * pool gives depends on this setting, so it is honoured rather than picked:
+ * a test asserting the generic error against a client that actually leaks
+ * existence is asserting the wrong thing.
+ *
+ * The API default is `LEGACY`, and a client created in the Cognito console
+ * gets `ENABLED`, so a client created here without the setting behaves the way
+ * a client created by an SDK call or a CloudFormation template does.
+ */
+export class SimCognitoPreventUserExistenceErrors {
+    value;
+    constructor(requested) {
+        if (requested === undefined) {
+            this.value = legacy;
+            return;
+        }
+        if (!settings.includes(requested)) {
+            throw new SimCognitoInvalidParameterException(`PreventUserExistenceErrors '${requested}' is not a Cognito setting: ` +
+                `use one of ${settings.join(", ")}`);
+        }
+        this.value = requested;
+    }
+    /**
+     * Whether a sign-in naming an unknown user is refused as a wrong password
+     * rather than reported missing.
+     */
+    get hidesUserExistence() {
+        return this.value === enabled;
+    }
+}
+//# sourceMappingURL=sim-cognito-prevent-user-existence-errors.js.map

package/dist/service/cognito/user-pool/client/sim-cognito-prevent-user-existence-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-prevent-user-existence-errors.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-prevent-user-existence-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAEvF;;GAEG;AACH,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB;;GAEG;AACH,MAAM,OAAO,GAAG,SAAS,CAAC;AAE1B,MAAM,QAAQ,GAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEtD;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,oCAAoC;IAC/B,KAAK,CAAS;IAE9B,YAAY,SAA6B;QACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,mCAAmC,CAC3C,+BAA+B,SAAS,8BAA8B;gBACpE,cAAc,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,IAAI,kBAAkB;QACpB,OAAO,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC;IAChC,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-factory.d.ts

@@ -10,6 +10,7 @@ interface SimCognitoMakeUserPoolClientProperties {
     readonly name: string | undefined;
     readonly generateSecret?: boolean | undefined;
     readonly explicitAuthFlows?: readonly string[] | undefined;
+    readonly preventUserExistenceErrors?: string | undefined;
     readonly tokenValidity: SimCognitoTokenValidityInput;
 }
 /**

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-client-factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGtE,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAG7E,UAAU,yCAAyC;IACjD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,aAAa,EAAE,4BAA4B,CAAC;CACtD;AAED;;GAEG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,yCAAyC,EAEhE;IAED;;;;;;OAMG;IACH,IAAI,CACF,UAAU,EAAE,sCAAsC,GACjD,wBAAwB,CAiB1B;IAED,OAAO,CAAC,SAAS;CAOlB"}
+{"version":3,"file":"sim-cognito-user-pool-client-factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAItE,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAG7E,UAAU,yCAAyC;IACjD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,sCAAsC;IAC9C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,aAAa,EAAE,4BAA4B,CAAC;CACtD;AAED;;GAEG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,yCAAyC,EAEhE;IAED;;;;;;OAMG;IACH,IAAI,CACF,UAAU,EAAE,sCAAsC,GACjD,wBAAwB,CAoB1B;IAED,OAAO,CAAC,SAAS;CAOlB"}

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-factory.js

@@ -1,6 +1,7 @@
 import { SimCognitoName } from "../sim-cognito-name.js";
 import { makeSimCognitoClientSecret } from "./sim-cognito-client-secret.js";
 import { SimCognitoExplicitAuthFlows } from "./sim-cognito-explicit-auth-flows.js";
+import { SimCognitoPreventUserExistenceErrors } from "./sim-cognito-prevent-user-existence-errors.js";
 import { SimCognitoTokenValidity, } from "./sim-cognito-token-validity.js";
 import { SimCognitoUserPoolClient } from "./sim-cognito-user-pool-client.js";
 import { makeSimCognitoUserPoolClientId } from "./sim-cognito-user-pool-client-id.js";
@@ -30,6 +31,7 @@ export class SimCognitoUserPoolClientFactory {
             }),
             secret: this.secretFor(properties.generateSecret),
             explicitAuthFlows: new SimCognitoExplicitAuthFlows(properties.explicitAuthFlows),
+            preventUserExistenceErrors: new SimCognitoPreventUserExistenceErrors(properties.preventUserExistenceErrors),
             tokenValidity: new SimCognitoTokenValidity(properties.tokenValidity),
             createdDate: this.clock.now(),
         });

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-client-factory.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,uBAAuB,GAExB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AActF;;GAEG;AACH,MAAM,OAAO,+BAA+B;IACzB,KAAK,CAAW;IAEjC,YAAY,UAAqD;QAC/D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CACF,UAAkD;QAElD,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAE5B,OAAO,IAAI,wBAAwB,CAAC;YAClC,EAAE,EAAE,8BAA8B,CAAC,IAAI,CAAC,SAAS,CAAC;YAClD,UAAU,EAAE,IAAI,CAAC,EAAE;YACnB,IAAI,EAAE,IAAI,cAAc,CAAC;gBACvB,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,UAAU,CAAC,IAAI;aACvB,CAAC;YACF,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC;YACjD,iBAAiB,EAAE,IAAI,2BAA2B,CAChD,UAAU,CAAC,iBAAiB,CAC7B;YACD,aAAa,EAAE,IAAI,uBAAuB,CAAC,UAAU,CAAC,aAAa,CAAC;YACpE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,cAAmC;QACnD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,0BAA0B,EAAE,CAAC;IACtC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-client-factory.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client-factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AACtG,OAAO,EACL,uBAAuB,GAExB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAetF;;GAEG;AACH,MAAM,OAAO,+BAA+B;IACzB,KAAK,CAAW;IAEjC,YAAY,UAAqD;QAC/D,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CACF,UAAkD;QAElD,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAE5B,OAAO,IAAI,wBAAwB,CAAC;YAClC,EAAE,EAAE,8BAA8B,CAAC,IAAI,CAAC,SAAS,CAAC;YAClD,UAAU,EAAE,IAAI,CAAC,EAAE;YACnB,IAAI,EAAE,IAAI,cAAc,CAAC;gBACvB,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,UAAU,CAAC,IAAI;aACvB,CAAC;YACF,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC;YACjD,iBAAiB,EAAE,IAAI,2BAA2B,CAChD,UAAU,CAAC,iBAAiB,CAC7B;YACD,0BAA0B,EAAE,IAAI,oCAAoC,CAClE,UAAU,CAAC,0BAA0B,CACtC;YACD,aAAa,EAAE,IAAI,uBAAuB,CAAC,UAAU,CAAC,aAAa,CAAC;YACpE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,cAAmC;QACnD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,0BAA0B,EAAE,CAAC;IACtC,CAAC;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client.d.ts

@@ -1,6 +1,7 @@
 import type { SimCognitoName } from "../sim-cognito-name.js";
 import type { SimCognitoUserPoolId } from "../sim-cognito-user-pool-id.js";
 import type { SimCognitoExplicitAuthFlows } from "./sim-cognito-explicit-auth-flows.js";
+import type { SimCognitoPreventUserExistenceErrors } from "./sim-cognito-prevent-user-existence-errors.js";
 import type { SimCognitoTokenValidity } from "./sim-cognito-token-validity.js";
 import type { SimCognitoUserPoolClientId } from "./sim-cognito-user-pool-client-id.js";
 interface SimCognitoUserPoolClientProperties {
@@ -9,6 +10,7 @@ interface SimCognitoUserPoolClientProperties {
     readonly name: SimCognitoName;
     readonly secret: string | undefined;
     readonly explicitAuthFlows: SimCognitoExplicitAuthFlows;
+    readonly preventUserExistenceErrors: SimCognitoPreventUserExistenceErrors;
     readonly tokenValidity: SimCognitoTokenValidity;
     readonly createdDate: Date;
 }
@@ -25,6 +27,7 @@ export declare class SimCognitoUserPoolClient {
     readonly userPoolId: SimCognitoUserPoolId;
     readonly name: string;
     readonly explicitAuthFlows: SimCognitoExplicitAuthFlows;
+    readonly preventUserExistenceErrors: SimCognitoPreventUserExistenceErrors;
     readonly tokenValidity: SimCognitoTokenValidity;
     readonly creationDate: Date;
     /**

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-client.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAEvF,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,EAAE,EAAE,0BAA0B,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;IACxD,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,EAAE,EAAE,0BAA0B,CAAC;IAC/C,SAAgB,UAAU,EAAE,oBAAoB,CAAC;IACjD,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/D,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IACvD,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC;;;OAGG;IACH,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3C,YAAY,UAAU,EAAE,kCAAkC,EAQzD;IAED;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-client.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,gDAAgD,CAAC;AAC3G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAEvF,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,EAAE,EAAE,0BAA0B,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;IACxD,QAAQ,CAAC,0BAA0B,EAAE,oCAAoC,CAAC;IAC1E,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACnC,SAAgB,EAAE,EAAE,0BAA0B,CAAC;IAC/C,SAAgB,UAAU,EAAE,oBAAoB,CAAC;IACjD,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,iBAAiB,EAAE,2BAA2B,CAAC;IAC/D,SAAgB,0BAA0B,EAAE,oCAAoC,CAAC;IACjF,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IACvD,SAAgB,YAAY,EAAE,IAAI,CAAC;IAEnC;;;OAGG;IACH,SAAgB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3C,YAAY,UAAU,EAAE,kCAAkC,EASzD;IAED;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,IAAI,CAE3B;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;CACF"}

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client.js

@@ -11,6 +11,7 @@ export class SimCognitoUserPoolClient {
     userPoolId;
     name;
     explicitAuthFlows;
+    preventUserExistenceErrors;
     tokenValidity;
     creationDate;
     /**
@@ -24,6 +25,7 @@ export class SimCognitoUserPoolClient {
         this.name = properties.name.value;
         this.secret = properties.secret;
         this.explicitAuthFlows = properties.explicitAuthFlows;
+        this.preventUserExistenceErrors = properties.preventUserExistenceErrors;
         this.tokenValidity = properties.tokenValidity;
         this.creationDate = properties.createdDate;
     }

package/dist/service/cognito/user-pool/client/sim-cognito-user-pool-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cognito-user-pool-client.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client.ts"],"names":[],"mappings":"AAgBA;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IACnB,EAAE,CAA6B;IAC/B,UAAU,CAAuB;IACjC,IAAI,CAAS;IACb,iBAAiB,CAA8B;IAC/C,aAAa,CAA0B;IACvC,YAAY,CAAO;IAEnC;;;OAGG;IACa,MAAM,CAAqB;IAE3C,YAAY,UAA8C;QACxD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;IACnC,CAAC;CACF"}
+{"version":3,"file":"sim-cognito-user-pool-client.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/client/sim-cognito-user-pool-client.ts"],"names":[],"mappings":"AAkBA;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IACnB,EAAE,CAA6B;IAC/B,UAAU,CAAuB;IACjC,IAAI,CAAS;IACb,iBAAiB,CAA8B;IAC/C,0BAA0B,CAAuC;IACjE,aAAa,CAA0B;IACvC,YAAY,CAAO;IAEnC;;;OAGG;IACa,MAAM,CAAqB;IAE3C,YAAY,UAA8C;QACxD,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACtD,IAAI,CAAC,0BAA0B,GAAG,UAAU,CAAC,0BAA0B,CAAC;QACxE,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;IACnC,CAAC;CACF"}

package/dist/service/cognito/user-pool/group/sim-cognito-group-factory.d.ts

@@ -0,0 +1,26 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimCognitoUserPool } from "../sim-cognito-user-pool.js";
+import { SimCognitoGroup } from "./sim-cognito-group.js";
+import type { SimCognitoGroupName } from "./sim-cognito-group-name.js";
+import type { SimCognitoGroupSettings } from "./sim-cognito-group-settings.js";
+interface SimCognitoGroupFactoryProperties {
+    readonly clock: SimClock;
+}
+interface SimCognitoMakeGroupProperties {
+    readonly pool: SimCognitoUserPool;
+    readonly name: SimCognitoGroupName;
+    readonly settings: SimCognitoGroupSettings;
+}
+/**
+ * Builds simulated groups, which start with no members.
+ */
+export declare class SimCognitoGroupFactory {
+    private readonly clock;
+    constructor(properties: SimCognitoGroupFactoryProperties);
+    /**
+     * Make a new group for a pool.
+     */
+    make(properties: SimCognitoMakeGroupProperties): SimCognitoGroup;
+}
+export {};
+//# sourceMappingURL=sim-cognito-group-factory.d.ts.map

package/dist/service/cognito/user-pool/group/sim-cognito-group-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-group-factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/group/sim-cognito-group-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE/E,UAAU,gCAAgC;IACxC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,UAAU,6BAA6B;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;CAC5C;AAED;;GAEG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,gCAAgC,EAEvD;IAED;;OAEG;IACH,IAAI,CAAC,UAAU,EAAE,6BAA6B,GAAG,eAAe,CAO/D;CACF"}

package/dist/service/cognito/user-pool/group/sim-cognito-group-factory.js

@@ -0,0 +1,22 @@
+import { SimCognitoGroup } from "./sim-cognito-group.js";
+/**
+ * Builds simulated groups, which start with no members.
+ */
+export class SimCognitoGroupFactory {
+    clock;
+    constructor(properties) {
+        this.clock = properties.clock;
+    }
+    /**
+     * Make a new group for a pool.
+     */
+    make(properties) {
+        return new SimCognitoGroup({
+            name: properties.name,
+            userPoolId: properties.pool.id,
+            settings: properties.settings,
+            clock: this.clock,
+        });
+    }
+}
+//# sourceMappingURL=sim-cognito-group-factory.js.map

package/dist/service/cognito/user-pool/group/sim-cognito-group-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-group-factory.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/group/sim-cognito-group-factory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAczD;;GAEG;AACH,MAAM,OAAO,sBAAsB;IAChB,KAAK,CAAW;IAEjC,YAAY,UAA4C;QACtD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,UAAyC;QAC5C,OAAO,IAAI,eAAe,CAAC;YACzB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE;YAC9B,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/user-pool/group/sim-cognito-group-name.d.ts

@@ -0,0 +1,10 @@
+import type { Brand } from "../../../../util/brand.type.js";
+export type SimCognitoGroupName = Brand<string, "SimCognitoGroupName">;
+/**
+ * Read a requested group name, or refuse a malformed one.
+ *
+ * A group name is the identifier every group operation names a group by, and
+ * it takes the same form as a username, which is where the rule lives.
+ */
+export declare function requireSimCognitoGroupName(value: string | undefined): SimCognitoGroupName;
+//# sourceMappingURL=sim-cognito-group-name.d.ts.map

package/dist/service/cognito/user-pool/group/sim-cognito-group-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-group-name.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/group/sim-cognito-group-name.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAG5D,MAAM,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;AAEvE;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,mBAAmB,CAMrB"}

package/dist/service/cognito/user-pool/group/sim-cognito-group-name.js

@@ -0,0 +1,15 @@
+import { SimCognitoIdentifier } from "../sim-cognito-identifier.js";
+/**
+ * Read a requested group name, or refuse a malformed one.
+ *
+ * A group name is the identifier every group operation names a group by, and
+ * it takes the same form as a username, which is where the rule lives.
+ */
+export function requireSimCognitoGroupName(value) {
+    return new SimCognitoIdentifier({
+        field: "GroupName",
+        subject: "group",
+        value,
+    }).value;
+}
+//# sourceMappingURL=sim-cognito-group-name.js.map

package/dist/service/cognito/user-pool/group/sim-cognito-group-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-group-name.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/group/sim-cognito-group-name.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAIpE;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAyB;IAEzB,OAAO,IAAI,oBAAoB,CAAC;QAC9B,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,OAAO;QAChB,KAAK;KACN,CAAC,CAAC,KAA4B,CAAC;AAClC,CAAC"}

package/dist/service/cognito/user-pool/group/sim-cognito-group-settings.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The properties of a group that a request can set.
+ *
+ * `GroupName` is not among them: it identifies the group, and `UpdateGroup`
+ * cannot change it.
+ */
+export interface SimCognitoGroupSettingsInput {
+    readonly Description?: string | undefined;
+    readonly Precedence?: number | undefined;
+    readonly RoleArn?: string | undefined;
+}
+/**
+ * The settable properties of one simulated group.
+ *
+ * All three are optional, and a group created without them reports none of
+ * them, as real Cognito reports only the properties a group has.
+ */
+export declare class SimCognitoGroupSettings {
+    readonly description: string | undefined;
+    readonly precedence: number | undefined;
+    readonly roleArn: string | undefined;
+    constructor(input?: SimCognitoGroupSettingsInput);
+    private static description;
+    /**
+     * Read a requested precedence.
+     *
+     * Zero is a precedence like any other, and the strongest one, so it is kept
+     * rather than treated as nothing.
+     */
+    private static precedence;
+    private static roleArn;
+}
+//# sourceMappingURL=sim-cognito-group-settings.d.ts.map

package/dist/service/cognito/user-pool/group/sim-cognito-group-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-group-settings.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/group/sim-cognito-group-settings.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAuBD;;;;;GAKG;AACH,qBAAa,uBAAuB;IAClC,SAAgB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChD,SAAgB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,SAAgB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5C,YAAY,KAAK,GAAE,4BAAiC,EAInD;IAED,OAAO,CAAC,MAAM,CAAC,WAAW;IAW1B;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,UAAU;IAczB,OAAO,CAAC,MAAM,CAAC,OAAO;CAkBvB"}

package/dist/service/cognito/user-pool/group/sim-cognito-group-settings.js

@@ -0,0 +1,68 @@
+import { SimCognitoInvalidParameterException } from "../../error/sim-cognito.error.js";
+const maxDescriptionLength = 2048;
+/**
+ * The highest precedence Cognito accepts. Zero is the strongest, and a group
+ * with no precedence at all is weaker than any of them.
+ */
+const maxPrecedence = 2 ** 31 - 1;
+const roleArnLength = { least: 20, most: 2048 };
+/**
+ * The ARN form Cognito accepts for a group's role.
+ *
+ * Every part is limited to the characters Cognito allows, resource included:
+ * an ARN holding a character it rejects has to fail here rather than in a
+ * deployment. Real Cognito also caps the resource at three colon-separated
+ * segments, which this does not count.
+ */
+const roleArnPattern = /^arn:[\w+=/,.@-]+:[\w+=/,.@-]+:[\w+=/,.@-]*:\d+:[\w+=/,.@:-]+$/u;
+/**
+ * The settable properties of one simulated group.
+ *
+ * All three are optional, and a group created without them reports none of
+ * them, as real Cognito reports only the properties a group has.
+ */
+export class SimCognitoGroupSettings {
+    description;
+    precedence;
+    roleArn;
+    constructor(input = {}) {
+        this.description = SimCognitoGroupSettings.description(input.Description);
+        this.precedence = SimCognitoGroupSettings.precedence(input.Precedence);
+        this.roleArn = SimCognitoGroupSettings.roleArn(input.RoleArn);
+    }
+    static description(value) {
+        if (value !== undefined && value.length > maxDescriptionLength) {
+            throw new SimCognitoInvalidParameterException(`Description is longer than the ${String(maxDescriptionLength)} ` +
+                `characters Cognito allows`);
+        }
+        return value;
+    }
+    /**
+     * Read a requested precedence.
+     *
+     * Zero is a precedence like any other, and the strongest one, so it is kept
+     * rather than treated as nothing.
+     */
+    static precedence(value) {
+        if (value === undefined) {
+            return undefined;
+        }
+        if (!Number.isSafeInteger(value) || value < 0 || value > maxPrecedence) {
+            throw new SimCognitoInvalidParameterException(`Precedence must be a whole number between 0 and ${String(maxPrecedence)}`);
+        }
+        return value;
+    }
+    static roleArn(value) {
+        if (value === undefined) {
+            return undefined;
+        }
+        if (value.length < roleArnLength.least ||
+            value.length > roleArnLength.most ||
+            !roleArnPattern.test(value)) {
+            throw new SimCognitoInvalidParameterException(`RoleArn '${value}' is not an ARN: a group's role takes the ` +
+                `'arn:aws:iam::<account>:role/<name>' form`);
+        }
+        return value;
+    }
+}
+//# sourceMappingURL=sim-cognito-group-settings.js.map

package/dist/service/cognito/user-pool/group/sim-cognito-group-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-group-settings.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/group/sim-cognito-group-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mCAAmC,EAAE,MAAM,kCAAkC,CAAC;AAcvF,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC;;;GAGG;AACH,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAElC,MAAM,aAAa,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,cAAc,GAClB,iEAAiE,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IAClB,WAAW,CAAqB;IAChC,UAAU,CAAqB;IAC/B,OAAO,CAAqB;IAE5C,YAAY,KAAK,GAAiC,EAAE;QAClD,IAAI,CAAC,WAAW,GAAG,uBAAuB,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,GAAG,uBAAuB,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;IAEO,MAAM,CAAC,WAAW,CAAC,KAAyB;QAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;YAC/D,MAAM,IAAI,mCAAmC,CAC3C,kCAAkC,MAAM,CAAC,oBAAoB,CAAC,GAAG;gBAC/D,2BAA2B,CAC9B,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,UAAU,CAAC,KAAyB;QACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,aAAa,EAAE,CAAC;YACvE,MAAM,IAAI,mCAAmC,CAC3C,mDAAmD,MAAM,CAAC,aAAa,CAAC,EAAE,CAC3E,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,OAAO,CAAC,KAAyB;QAC9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IACE,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC,KAAK;YAClC,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC,IAAI;YACjC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAC3B,CAAC;YACD,MAAM,IAAI,mCAAmC,CAC3C,YAAY,KAAK,4CAA4C;gBAC3D,2CAA2C,CAC9C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/service/cognito/user-pool/group/sim-cognito-group-store.d.ts

@@ -0,0 +1,45 @@
+import type { SimCognitoGroup } from "./sim-cognito-group.js";
+import type { SimCognitoGroupName } from "./sim-cognito-group-name.js";
+/**
+ * The groups of one simulated user pool.
+ *
+ * Groups are keyed by name, which is what every group operation names one by,
+ * and a name is unique within its pool.
+ */
+export declare class SimCognitoGroupStore {
+    private readonly groups;
+    /**
+     * Every group in this pool, in creation order.
+     */
+    get all(): readonly SimCognitoGroup[];
+    /**
+     * Store a newly created group, refusing a name the pool already holds.
+     */
+    add(group: SimCognitoGroup): void;
+    /**
+     * Forget a deleted group, and with it the membership of its users.
+     */
+    remove(group: SimCognitoGroup): void;
+    /**
+     * Find a group by name.
+     */
+    find(groupName: string): SimCognitoGroup | undefined;
+    /**
+     * Resolve a group by name, or refuse.
+     */
+    require(groupName: SimCognitoGroupName): SimCognitoGroup;
+    /**
+     * The groups a user belongs to, strongest precedence first.
+     *
+     * This is the order the `cognito:groups` claim will use, so a caller
+     * reading the first group gets the one whose role would reach the
+     * `cognito:preferred_role` claim. Groups with no precedence come last, and
+     * groups sharing one keep the order they were created in.
+     */
+    forUser(username: string): readonly SimCognitoGroup[];
+    /**
+     * Take a deleted user out of every group.
+     */
+    forgetUser(username: string): void;
+}
+//# sourceMappingURL=sim-cognito-group-store.d.ts.map

package/dist/service/cognito/user-pool/group/sim-cognito-group-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-group-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/group/sim-cognito-group-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAUvE;;;;;GAKG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAE7D;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,eAAe,EAAE,CAEpC;IAED;;OAEG;IACH,GAAG,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAQhC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAEnC;IAED;;OAEG;IACH,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAEnD;IAED;;OAEG;IACH,OAAO,CAAC,SAAS,EAAE,mBAAmB,GAAG,eAAe,CAUvD;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,eAAe,EAAE,CAQpD;IAED;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAIjC;CACF"}

package/dist/service/cognito/user-pool/group/sim-cognito-group-store.js

@@ -0,0 +1,77 @@
+import { SimCognitoGroupExistsException, SimCognitoResourceNotFoundException, } from "../../error/sim-cognito.error.js";
+/**
+ * The precedence a group with none of its own sorts at.
+ *
+ * Real Cognito treats a group with no precedence as weaker than any group
+ * that has one, and the highest precedence a request can set is `2^31 - 1`.
+ */
+const weakestPrecedence = Number.MAX_SAFE_INTEGER;
+/**
+ * The groups of one simulated user pool.
+ *
+ * Groups are keyed by name, which is what every group operation names one by,
+ * and a name is unique within its pool.
+ */
+export class SimCognitoGroupStore {
+    groups = new Map();
+    /**
+     * Every group in this pool, in creation order.
+     */
+    get all() {
+        return this.groups.values().toArray();
+    }
+    /**
+     * Store a newly created group, refusing a name the pool already holds.
+     */
+    add(group) {
+        if (this.groups.has(group.name)) {
+            throw new SimCognitoGroupExistsException(`A group with the name ${group.name} already exists.`);
+        }
+        this.groups.set(group.name, group);
+    }
+    /**
+     * Forget a deleted group, and with it the membership of its users.
+     */
+    remove(group) {
+        this.groups.delete(group.name);
+    }
+    /**
+     * Find a group by name.
+     */
+    find(groupName) {
+        return this.groups.get(groupName);
+    }
+    /**
+     * Resolve a group by name, or refuse.
+     */
+    require(groupName) {
+        const found = this.find(groupName);
+        if (found === undefined) {
+            throw new SimCognitoResourceNotFoundException(`Group ${groupName} does not exist.`);
+        }
+        return found;
+    }
+    /**
+     * The groups a user belongs to, strongest precedence first.
+     *
+     * This is the order the `cognito:groups` claim will use, so a caller
+     * reading the first group gets the one whose role would reach the
+     * `cognito:preferred_role` claim. Groups with no precedence come last, and
+     * groups sharing one keep the order they were created in.
+     */
+    forUser(username) {
+        return this.all
+            .filter((group) => group.hasMember(username))
+            .toSorted((one, other) => (one.precedence ?? weakestPrecedence) -
+            (other.precedence ?? weakestPrecedence));
+    }
+    /**
+     * Take a deleted user out of every group.
+     */
+    forgetUser(username) {
+        for (const group of this.all) {
+            group.removeMember(username);
+        }
+    }
+}
+//# sourceMappingURL=sim-cognito-group-store.js.map

package/dist/service/cognito/user-pool/group/sim-cognito-group-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-group-store.js","sourceRoot":"","sources":["../../../../../src/service/cognito/user-pool/group/sim-cognito-group-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,kCAAkC,CAAC;AAI1C;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,CAAC;AAElD;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACd,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE7D;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,KAAsB;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,8BAA8B,CACtC,yBAAyB,KAAK,CAAC,IAAI,kBAAkB,CACtD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAsB;QAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,SAAiB;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,SAA8B;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,mCAAmC,CAC3C,SAAS,SAAS,kBAAkB,CACrC,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,QAAgB;QACtB,OAAO,IAAI,CAAC,GAAG;aACZ,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;aAC5C,QAAQ,CACP,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CACb,CAAC,GAAG,CAAC,UAAU,IAAI,iBAAiB,CAAC;YACrC,CAAC,KAAK,CAAC,UAAU,IAAI,iBAAiB,CAAC,CAC1C,CAAC;IACN,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,QAAgB;QACzB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF"}